Guide to Network Defense and Countermeasures

1. Guide to Network Defense and Countermeasures Chapter 10

2. Chapter 10 - Intrusion Detection: Incident Response • Develop an Incident Response Team for your organization • Follow the six-step incident response process • Describe how to respond to false alarms to reduce reoccurrences • Understand options for dealing with legitimate security alerts • Describe computer forensics activities you can use to investigate hackers

3. Developing a Security Incident Response Team (SIRT) • A Security Incident Response Team (SIRT) is a group of individuals who are assigned to respond effectively to security breaches • The team’s primary functions are: • Preparation - create the SIRT; begin with a risk analysis and security policy • Notification - Monitor the computing environment in order to uncover vulnerabilities; receive notification from your IDS and firewall

4. Developing a Security Incident Response Team (SIRT) • The SIRT’s primary functions (cont.): • Response - React to security breaches and policy violations; determine who to notify; determine legitimacy of the attack; assess the level of damage • Countermeasures - Contain the damage and eradicate any harmful or unauthorized files; take corrective measures to prevent recurrence • Recovery - Restore damaged files and resources • Follow-up - record what happened; conduct forensics if necessary; decide whether to prosecute the offenders; adjust security policies as needed

6. Developing a Security Incident Response Team (SIRT) • Members of a SIRT are best chosen from within the organization • SIRT members need to have the ability to stop work in order to respond to a security incident; they should also be given sufficient authority to make decisions regarding security measures • SIRT members should represent a cross-section of the company, so that they can act as advocates of, or spokespersons to their part of the organization; typically represented are: management; legal; IT; physical security; IS; HR; public relations; finance

7. Developing a Security Incident Response Team (SIRT) • SIRT members (cont.): • The speed and thoroughness with which you are able to respond to security alerts depends in large amount on the number of employees involved and how many other duties they perform • If feasible, assemble a group of employees whose sole responsibility is security and related matters; some companies may need to assign people to respond to incidents in addition to their every day tasks; the best level of response comes from an individual or team that performs security tasks only

8. Developing a Security Incident Response Team (SIRT) • SIRT members (cont.): • Once the SIRT is in place and has begun meeting, the next step involves conducting a security drill • Pick a time for the security drill to occur, and then follow a scenario in which you assume that an attack has occurred; SIRT members should be contacted and should respond as they would in a real incident; test the notification process and next test the response process • Such drills are intended to identify any holes in security procedures, and to make sure the SIRT members know their duties and responsibilities

9. Developing a Security Incident Response Team (SIRT) • SIRT members (cont.): • A number of Public Resource Teams have been assembled around the world in order to publish notices and articles about serious security incidents • These Public Resource Teams can be contacted if a significant security event is encountered; these groups provide expertise, ability to coordinate resources, and provide training for response teams • It may be necessary to outsource incident response needs; this choice may result in overall lower costs, but response time and effectiveness may suffer

10. How to Respond:The Incident Report Process • The process of intrusion response is usually broken down into a series of steps: • Preparation - perform a risk analysis (assesses the impact of lost resources), and use it to prepare a security policy (describes network defenses, how the organization responds to intrusions, and provides SIRT recommendations); monitoring involves actively testing your network to see how it reacts to scans and other events - do this by means of a network vulnerability analyzer such as SAINT (Security Administrator’s Integrated Network Tool)

12. How to Respond:The Incident Report Process • The process of intrusion (cont.): • Notification - notification is the process by which the appropriate members of the SIRT receive news about security incidents; notification may come from a firewall, IDS, other SIRT members, or from a network administrator; after the initial response, the next step is to assess the level of damage and determine whether to escalate the incident; a wider range of individuals is notified as the level of impact grows more serious

13. How to Respond:The Incident Report Process • The process of intrusion (cont.): • Response - when an intrusion occurs the SIRT members should remember to not panic and to follow established procedures; an important aspect of response is having escalation procedures clearly spelled out and in place - do this in the form of a flow chart; if the incident is legitimate, other SIRT members must be notified - determine what needs to be reported, who needs to know it, and how quickly reporting is needed; set up a hotline and a contact list to facilitate response procedures

16. How to Respond:The Incident Report Process • The process of intrusion (cont.): • Countermeasures - containment and eradication control damage; containment prevents a malicious entity from spreading; to curtail the effects, consider system shut down, disabling user/group accounts, disabling exploited services, or backing up affected systems; eradication follows containment and the goal is to remove files resulting from the intrusion; to remove the danger, scan affected systems, ensure no new users have been added, check services, and check .DLL and the Windows registry; you may simply need to rebuild the affected system

17. How to Respond:The Incident Report Process • The process of intrusion (cont.): • Recovery - putting compromised resources back in service; once reintroduced, ensure no vulnerabilities by monitoring the resource for at least 1 day; next, adjust packet filter rules to block any offending Web sites involved in the attack • Follow-up - document what took place after an intrusion and its response so as to prevent another attack like it; prevention is more likely if you include all of the events associated with an incident in your record-keeping, and you reevaluate policies and add or adjust them where necessary

18. Dealing with False Alarms • An essential activity of managing an IDS is minimizing false alarms and missed alarms • When false alarms occur, adjust firewall, packet filter,or IDS rules so as to reduce them in the future • Reduce alerts by excluding specific signatures from connecting to an internal IP address • In some cases, disabling entire signatures will stop the triggering of false alarms - like when testing the network and doing a port scan; also, if one IDS contains a signature, exclude it on other IDSs • Be sure to record false alarms on tracking charts

20. Dealing with LegitimateSecurity Alerts • In order to assess legitimate intrusions, look for these indications: • System crashes • New user accounts suddenly appear and little-used accounts suddenly have heavy traffic • New files appear, often with strange file names • A series of unsuccessful logon attempts occurs • Provided the event turns out to be legitimate, respond calmly and follow procedures spelled out clearly in the security policy

21. Dealing with LegitimateSecurity Alerts • Assessing the impact of legitimate attacks: • Find out if any host computers were compromised by locating any files that were added to network computers and which ones were changed; use the software tool Tripwire to document file system changes since the last baseline test • Determine the scope and impact of the problem: were multiple sites affected? How many computers were involved? You must check each computer by running virus scans and checking firewall logs; if the firewall was compromised, it will have to be reconstructed from scratch

23. Dealing with LegitimateSecurity Alerts • Develop an Action plan that includes: • An assessment of the seriousness of the attack • If serious, immediate notification of team leader • Documentation of all of your actions • Disconnecting the computer to contain the threat • Determining the extent of the damage • Making a backup, if prosecution is possible • Steps to eradicate the problem • Restoring the system and monitoring it for integrity • Recording a summary of the incident

24. Dealing with LegitimateSecurity Alerts • Internal versus external incidents: • When it is suspected that an employee may be involved, the response needs to be more measured than if a hacker is attacking the system - once the employee is known, contact HR and the Legal department - they can begin disciplinary action • Corrective measures to prevent reoccurrence • Depending on the nature of the incident, you may need to download signatures and update rules; as well, others on the Internet may need to be notified about your attack

25. Dealing with LegitimateSecurity Alerts • Working under pressure can cause certain key aspects of effective response to be overlooked • It is beneficial to fill out a response checklist for each incident; this helps you to keep track of data that is essential to incident response operations • Gathering data for prosecution: • Make sure two people handle the data at all times • Write everything down • Duplicate the data and lock it all up • The security policy should spell out which incidents will lead to prosecution

27. After the Attack:Computer Forensics • Computer forensics is the set of activities associated with finding out who hacked into a system, or who gained unauthorized access • Forensics is usually implemented with the goal of gaining enough legally admissible evidence to prosecute the person responsible for the crime • The goal is to determine as accurately as possible the facts of what happened • Computer forensics examines computers and networks where electronic crimes take place

28. After the Attack:Computer Forensics • Tracing attacks may or may not help find the identification of the perpetrator • Identification can be difficult if the offender falsified the IP address listed as the source, or they may have gained access to someone else’s computer and used it to launch the attacks • Many incident handlers keep a forensics toolkit of hardware and software in order to respond to alerts • Such a kit may include a laptop, a cell phone, backup CD-ROMs or other disks, cables, hubs and software for copying files and detecting viruses

29. After the Attack:Computer Forensics • Tracing attacks (cont.): • Toolkit or not, you should have forensics software that can copy media or scan the files on a disk to determine how users have been using their PCs • Simply copying files is not adequate for forensics purposes - the software must either clone a disk (copying the entire bit stream of a disk to a similar object) or make an image of it (a copy of an entire disk that is saved on another tape or storage media • Programs such a Byte Back, DriveImage, and Detective provide cloning, disk imaging, and more

31. After the Attack:Computer Forensics • Using data mining to discover patterns • Use your experience to prevent future attacks; if you discover the source of an attack, contact them and inform them that future attacks will not be tolerated • Prosecuting defenders • Prosecution should be considered in cases that result in financial fraud, inappropriate Web usage, theft of proprietary data, or sexual harassment; seek advice from computer crime investigators • Incidents within a legal framework require accurate electronic findings; take extensive notes as well

33. Chapter Summary • The members of a SIRT should be drawn from all of the major organizational areas. A wide-ranging membership gives the SIRT authority to take drastic measures, such as shutting down servers and requiring all employees to change their network passwords, to prevent attacks from widening. Having a member of higher management enables the SIRT to make such decisions. Legal staff can provide advise if prosecution is to be pursued, while HR staff can handle situations involving individual employees who turn out to be the source of intrusions. PR staff can communicate with the press and media, especially if the event causes Internet stoppage

34. Chapter Summary • The speed and thoroughness with which the response occurs depends on the range of employees involved and how many other duties the are required to perform. Ideally, you can hire a team of individuals whose sole job is to respond to incidents full-time. Otherwise, you can assign individual employees who have other tasks within the company to perform incident response on an on-needed basis. You can also outsource your incident response and security monitoring needs to one of the many contractors who provide such services

35. Chapter Summary • There are specific issues and approaches involved in responding to intrusions and security breaches. First, the establishment of a Security Incident Response Team (SIRT), a group of individuals who are assigned to respond to alerts, assess damage, call other team members, and take countermeasures to prevent further damage. The primary SIRT functions can be broken down into six steps: preparation, notification, response, countermeasures, recovery, and follow-up. These steps are part of a larger workflow that includes an initial risk to and analysis of the reevaluation of security policies following the successful completion of incident response steps

36. Chapter Summary • The process of responding to security incidents should be clearly defined in a brief document to which all SIRT members can refer. The response should be based on principles spelled out in the security policy. The SIRT should actively monitor and test the network in order to proactively block incidents • When incident notification occurs, the SIRT member on call should assess whether the incident is legitimate or false. For serious incidents, summon the SIRT team leader. Response may be illustrated in the form of a flowchart. A list containing contact information should be kept, as well as a form that members fill out when events occur

37. Chapter Summary • After initial response and assessment, containment and eradication countermeasures should be pursued. Containment involves preventing the malicious file or intruder from accessing any more resources on the network. After containment, eradication should occur to eliminate any malicious files, registry keys, viruses, or other files that have been introduced • After eradication, begin recovery of the affected media, programs, and computers that need to be put back into service. Finally, follow-up should take place: the incident should be described fully in a database or other file where future SIRT members can access it if similar events take place

38. Chapter Summary • False alarm are almost inevitable with any IDS. If false alarms are reported, adjust the rules used by firewalls, packet filters, or IDSs to reduce them in the future. You can exclude an IP address from attempting to access your network, or disable a signature if you need to • Legitimate attacks require calm, systematic, and thorough response. These attacks can be discerned from events such as system crashes or new user accounts or new files that suddenly appear. If a legitimate attack is detected, you need to determine how many computers have been damaged. Follow an action plan regardless of the seriousness

39. Chapter Summary • External attacks by hackers you identify may call for prosecution in court. In order to pursue a legal case, pursue computer forensics - the practice of tracking attacks, identifying offenders, handling evidence, and developing a legal case. Handle evidence carefully and document all steps taken in order to maintain a record of the chain of custody • Computer forensics involves the use of special hardware and software tools used to respond to alerts and analyze data. To ensure accurate analysis, the data should be cloned or a disk image created. The evidence gained through forensics can lead to prosecuting offenders